fix(server): bulk worktree launches no longer fail on Git races

[jakeleventhal]

Concurrent launches into one repository can fail on fetch ref locks, occupied branch names or paths, and shared Git config writes. Retry can hit the same collision again.

This keeps launches independent: concurrent fetches of the same ref share their in-flight result, branch/path collisions retry with a bounded suffix (temporary branches get a fresh hash), and branch creation, merge-base config writes, and renames share a lock keyed by the Git common directory. Checkout stays parallel. A launch never retries once it has claimed a worktree path, and retrying a failed thread keeps its existing run and message.

Maintainer takeover of @jakeleventhal’s #17197, preserving the contributor’s commits and merging current main. The implementation also locks upstream config written during branch creation. PR-added test cases were reduced from 13 to 4 across the existing launch and Git driver test files.

Verification on headless Linux:

• Real Git service integration: six simultaneous launches preserve an occupied branch, its uncommitted file, and an unrelated occupied directory. Each launch gets a separate worktree, branch, merge base, and upstream tracking.
• The five focused behavior checks pass: bulk launches, bounded collision retries recovering the same run, concurrent rename/config preservation, shared fetches, and claimed-worktree cleanup.
• Both complete touched suites: 246 passed, 1 failed. The existing review diff previews > preserves renames, unusual paths, modes, and binary statistics failure also reproduces with main’s production code.
• All four retained PR-added regression cases fail with main’s production implementation restored; they pass with this fix.
• Server typecheck, targeted lint, formatting, and diff checks pass.
• Two independent full-diff review rounds using Claude Opus 5.5 and Codex GPT-6 Sol. The first-round unused-branch concern was reproduced on main as well; it is disclosed below rather than adding branch deletion to this fix.

Service-level tests exercise the server and real temporary Git repositories; screenshots do not demonstrate this server concurrency behavior. No browser, Electron desktop, macOS, Windows, iOS, or Android verification was performed. Network fetch coalescing is verified with a controlled process fixture, not a live remote race.

Coordination is local to one Git driver instance; external Git processes do not use its locks. As with Git’s existing worktree add -b, an attempt that fails before claiming a worktree can leave an unused branch. Collision retries skip it without deleting existing work.

Implementation: GPT-6.1 Sol (high) through the Codex harness in T3 Code. Tests: GPT-6 Astra (high), Codex harness. Independent reviews: Claude Opus 5.5 and GPT-6 Sol.

[macroscopeapp]

Approvability

Verdict: Approved at bcedc86

Macroscope's review found this PR approvable — This is a localized server-side concurrency bug fix that makes existing bulk worktree launches resilient to Git ref, path, config, and fetch races. The production changes are confined to the orchestration and VCS layers, with focused tests covering the new retry and synchronization behavior.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 34c6bf5
• Latest commit, not reviewed: bcedc86

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 54d11896-684e-468f-b5de-52da6842890a

📥 Commits

Reviewing files that changed from the base of the PR and between ea5c623 and 34c6bf5.

📒 Files selected for processing: 4

• apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
• apps/server/src/orchestration-v2/ThreadLaunchService.ts
• apps/server/src/vcs/GitVcsDriverCore.test.ts
• apps/server/src/vcs/GitVcsDriverCore.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

GitVcsDriverCore classifies branch-ref collisions, serializes selected repository updates, and shares concurrent matching fetches. ThreadLaunchService retries eligible worktree branch or path collisions. Tests cover concurrent launches, retry limits, failure handling, recovery, and cleanup.

Changes: Git Concurrency and Worktree Provisioning

Layer / File(s)	Summary
Classify collisions and serialize Git updates apps/server/src/vcs/GitVcsDriverCore.ts, apps/server/src/vcs/GitVcsDriverCore.test.ts	The driver classifies existing refs/heads/... collisions as branch_already_exists and serializes worktree base-ref configuration and branch renames by repository. Tests cover ref collision classification and concurrent renames.
Coalesce matching remote fetches apps/server/src/vcs/GitVcsDriverCore.ts, apps/server/src/vcs/GitVcsDriverCore.test.ts	Concurrent fetches with the same working directory, remote, and optional ref share an in-flight operation. A later fetch starts a new operation after completion.
Retry eligible worktree collisions apps/server/src/orchestration-v2/ThreadLaunchService.ts, apps/server/src/orchestration-v2/ThreadLaunchService.test.ts	Worktree creation retries branch or path collisions before a path is claimed, up to 100 retries. Tests cover concurrent launches, temporary names, retry limits, recovery, and partial-checkout cleanup.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: bil0000

Merge Risk: ⚪ Minimal · up to 34c6b

The investigated concurrency and retry paths do not show a remaining obstacle to merging after normal checks.

Security architecture risk: 🔵 Low · up to 34c6b

The changes reduce Git races while preserving the repository and base reference used by each launch. No introduced security issue was established. Remaining uncertainty concerns partial Git failures before a worktree is reported as created, rather than a demonstrated expansion of access or privileges.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed retry flow operates within the selected project's repository and configured worktree location. It expands the number of candidate branch/path attempts, not the repository or base-reference authority passed to Git. The supplied evidence does not establish deployment-wide or tenant-wide exposure.

Trust Boundaries and Controls

• observed — The new atomic-ref collision classification is restricted to refs/heads. Only classified branch/path collisions enter the provisioning retry loop; authentication, host-key, and other failures do not satisfy its retry predicate. Git diagnostic classification excludes remote-prefixed output.

Resilience and Maintainability Implications

• observed — A reported worktree claim prevents collision retries. Failure before workspace recording, or cancellation before run release, attempts removal of the claimed path; thread metadata is cleared only after successful removal. Ordinary failure after recording preserves the workspace for recovery.
• observed — Ownership reporting occurs after successful git worktree add, and worktree removal contains no branch-ref deletion. Both behaviors existed at the PR base. Inspected evidence does not establish Git's partial-failure rollback before ownership reporting, so orphaned state or its amplification by retries is unresolved, not a verified introduced issue.

Hardening Proposals

• proposed — Add fault-injection coverage around real worktree creation, including interruption before ownership reporting and failure after ref creation. Establish which directory and ref state survives, and ensure recovery never deletes state owned by another launch.

Pre-merge checks: 1 · 1 · 2

Failed checks: 1 warning · 2 inconclusive

Check name	Status	Explanation	Resolution
Description check		The description covers the problem, implementation, scope, verification results, limitations, and agent attribution. However, it omits the required section headings and does not include an explicit ma…	Reformat the description with the required Problem, Change, Scope and approval, and Verification headings. Add a link to the explicit maintainer approval comment or explain why this focused bug fix qualifies for the approval exemption.
Linked Issues check		The linked issue assessment could not be completed.	Retry the assessment when the required review evidence is available.
Out of Scope Changes check		The linked issue assessment could not be completed.	Retry the assessment when the required review evidence is available.

Passed checks: 1 passed

Check name	Status	Explanation
Title check		The title clearly identifies the server fix for bulk worktree launch failures caused by Git races. It is concise and specific.

Full details: Description check

Explanation

The description covers the problem, implementation, scope, verification results, limitations, and agent attribution. However, it omits the required section headings and does not include an explicit maintainer approval comment or link as required by the Scope and approval section.

Resolution

Reformat the description with the required Problem, Change, Scope and approval, and Verification headings. Add a link to the explicit maintainer approval comment or explain why this focused bug fix qualifies for the approval exemption.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate b6bd69f

Dismissing prior approval to re-evaluate 34c6bf5

Dismissing prior approval to re-evaluate b044dc4

[juliusmarminge]

Taking over this one as maintainer for batch worktree-git-16. I will preserve author credit, merge current main, reduce the tests, rebuild the Git race fix, and run independent adversarial reviews. No merge is planned.

Dismissing prior approval to re-evaluate 6cb55dd